CVE-2023-52807

What it actually does

Out-of-bounds array access in the hns3 driver when coalesce information is read through debugfs after new modes or states are added to the kernel.

Why it matters to the business

Systems using Huawei hns3 network adapters risk kernel crashes or memory corruption when administrators inspect driver state via debugfs, potentially causing network outages or requiring reboots on affected Linux servers and appliances.

How an attack unfolds

An attacker with local access or the ability to trigger debugfs reads on a system with the hns3 driver can cause the kernel to read past the end of the coalesce string array, resulting in invalid memory access that may crash the system or leak kernel data.

How to fix it

Update the Linux kernel to a version containing commit 07f5b8c47152cadbd9102e053dcb60685820aa09 or later; rebuild and deploy the updated kernel on all affected systems using hns3 hardware.

How to confirm the fix worked

Confirm the running kernel contains commit 07f5b8c47152cadbd9102e053dcb60685820aa09; verify that reading coalesce info via debugfs no longer produces out-of-bounds warnings or crashes under added modes.

Typical attack path

1. Identify a target system running the vulnerable hns3 driver with debugfs mounted.
2. Navigate to the driver's debugfs directory for coalesce information.
3. Read the coalesce info file, triggering the out-of-bounds access.
4. Observe kernel panic, oops, or information disclosure resulting from the invalid memory read.

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for hns3 driver oops or slab-out-of-bounds messages triggered around the time coalesce debugfs files are accessed; correlate with process activity reading /sys/kernel/debug/ entries under hns3.

What your security team should do

• Prioritize kernel upgrade on all production systems exposing hns3 debugfs entries.
• Restrict debugfs access to trusted administrators only until patches are applied.
• Monitor kernel logs for hns3-related oops or out-of-bounds warnings as an interim detection measure.